Book Image

Learn Azure Sentinel

By : Richard Diver, Gary Bushey
Book Image

Learn Azure Sentinel

By: Richard Diver, Gary Bushey

Overview of this book

Azure Sentinel is a Security Information and Event Management (SIEM) tool developed by Microsoft to integrate cloud security and artificial intelligence (AI). Azure Sentinel not only helps clients identify security issues in their environment, but also uses automation to help resolve these issues. With this book, you’ll implement Azure Sentinel and understand how it can help find security incidents in your environment with integrated artificial intelligence, threat analysis, and built-in and community-driven logic. This book starts with an introduction to Azure Sentinel and Log Analytics. You’ll get to grips with data collection and management, before learning how to create effective Azure Sentinel queries to detect anomalous behaviors and patterns of activity. As you make progress, you’ll understand how to develop solutions that automate the responses required to handle security incidents. Finally, you’ll grasp the latest developments in security, discover techniques to enhance your cloud security architecture, and explore how you can contribute to the security community. By the end of this book, you’ll have learned how to implement Azure Sentinel to fit your needs and be able to protect your environment from cyber threats and other security issues.
Table of Contents (22 chapters)
1
Section 1: Design and Implementation
4
Section 2: Data Connectors, Management, and Queries
9
Section 3: Security Threat Hunting
14
Section 4: Integration and Automation
17
Section 5: Operational Guidance

Editing a workbook

There will be times when you need to edit a workbook. As you saw in the previous section, you need to edit a workbook created from scratch in order to add what you need to it. You can also edit workbooks created from templates to modify them to suit your needs.

If you are not already viewing your workbook, you will need to view it first. If you are already viewing your workbook, you can skip this next step and move directly to the editing portion.

To edit a workbook, perform the following steps:

  1. Go to either of the tabs.
  2. Select the workbook in question.
  3. Then, select the View saved workbook button in the workbook's detail pane.

    Note

    You cannot edit a workbook template directly. It must be saved first, and then the saved workbook can be edited. If you have created a workbook from scratch, you must go to the My workbooks tab since these workbooks have not been created from a template and only show up there.

At the top of the page will...